## HMRC - Information Management Action Plan

| Recommendation | Actions | Timescale | |----------------|---------|-----------| | 1. HMRC should continue to invest in the structures that have allowed for significant progress on information assurance, and more recently management of information, particularly during this period of efficiency savings. | 1.1 Re-affirmation of the Chief Executive’s commitment to Information Management. Director Generals to provide progress reports. 1.2 Maintain Information Champion and Data Guardian roles, ensure Lines of Business agree the action plan. | 6 months | | 2. HMRC should ensure that checking of compliance with KIM policies and standards is included as part of regular internal assurance processes | 2.1 Provide regular progress report on assurance activity to Director Generals/ExCOM 2.2 Optimise use of Internal Audit Programme | Between 6 months and 3 years | | 3. HMRC should develop a KIM performance measurement regime reporting to the SIRO. | 3.1 Develop KIM metrics for use across HMRC and within Lines of Business 3.2 Consult with Knowledge Council and others on best practice 3.2 Monitor and report progress to SIRO against this action plan and KIM metrics. | 12 months to 2 years | | 4. HMRC should better define the various KIM roles within the business, provide adequate support for those roles and improve communication of these roles to the staff. | 4.1 Formalise the roles and responsibilities as part of work on organisational design. 4.2 Publicise and communicate KIM roles, building networks and provide support. | 12 months | | 5. Building on progress made, HMRC should take advantage of the Information Assurance programme, and now expand the agenda to include the benefits of good information management. | 5.1 Define ‘what good looks like’ and communicate across HMRC. 5.2 Map the KIM agenda across to other Information Management initiatives. | Between 12 months and 3 years | | 6. HMRC needs to encourage staff to explore how they can maximise data flows to support delivery of its objectives while maintaining high | 6.1 Work with Data Guardians to ensure data continues to be shared while maintaining high security standards. | 3 years | | Recommendation | Actions | Timescale | |----------------|---------|-----------| | 7. Whilst The National Archives acknowledges the challenge in this complex information environment, HMRC should continue working to define key processes and their related information/data flows where relevant. | 7.1 Consult on how the Information/Data flow mapping work in the Departmental Security Programme will continue in the future including the role of process owners. | Between 6 and 12 months | | 8. HMRC should continue to improve its understanding of its key information assets | 8.1 Continue the work to identify and catalogue all information assets. | Between 6 months and 3 years | | 9. HMRC should harness the good work that has been initiated by local data integrity projects, sharing lessons learned across the organisation. | 9.1 Develop and deliver a communications plan to improve visibility of lessons learned. 9.3 Link to actions against recommendations 23 & 39 | 12 months | | 10. HMRC should work closely with The National Archives and adopt the ‘What to Keep’ guidance approach. | 10.1 Review the ‘What to Keep’ guidance and approach as advocated by TNA. 10.2 Benchmark TNA guidance against HMRC policies and amend as appropriate. 10.3 Communicate any updated guidance/standards. | 12 months | | 11. HMRC must introduce and implement appropriate retention schedules for head of duty systems. | 11.1 Identify short/medium and longer term activities to enable more routine secure disposal of business records. | Within 12 months – 5 years | | 12. HMRC needs to ensure that the owners of significant information assets are urgently identified at below Executive Committee level, agreed and assigned and that this is communicated appropriately. | 12.1 Continue ongoing work to further develop the Information Asset Owner role and communicate appropriately. | 12 months | | 13. HMRC should ensure business areas rationalise and delete files on migration into CAFs, sharing good local practices to facilitate the progress. | 13.1 Data Guardians to include CAF migration within their assurance activity. 13.2 Lines of Business to ensure files are weeded before migration into CAFs. 13.3 Promulgate best practice - Link to activities against | 12 months | | Recommendation | Actions | Timescale | |----------------|---------|-----------| | 14. HMRC to ensure that appropriate people with relevant skills are selected to fulfil the CAF Information Manager roles. | 14.1 Develop and communicate the role for CAF Information Managers. 14.2 Identify any training needs for the role. 14.3 Reallocate the role where appropriate | 12 months | | 15. HMRC should conduct compliance checks to ensure the integrity of the CAF creation and management process. | 15.1 Develop a checklist/standard for CAF creation and management. 15.2 Implement standards in business areas. 15.3 Establish reporting mechanisms to DRO on levels of compliance. | 6 months to 3 years | | 16. HMRC to ensure that corporate guidance is followed and that all areas have approved retention and disposal schedules that are fully implemented. | 16.1 Continue working with business areas that do not have retention policies for their information. 16.2 Develop a process that will facilitate ‘Spot Checking’ of adherence to retention policies in business areas. | 12 months to 3 years | | 17. HMRC to implement a systematic approach to managing paper based records. | 17.1 Establish the scope of the problem and identify short, medium and long term solutions for paper based assets. 17.2 Develop options for digitising and minimising paper collections. | 12 months to (5 years | | 18. HMRC should incorporate digital continuity into HMRC’s Gateway process for managing ongoing change. | 18.1 Work with stakeholders to improve the change process. 18.2 Publish and implement policy and strategy for digital continuity. | 12 months | | 19. HMRC needs to engage with its supplier to clarify the contractual responsibilities for digital continuity and agree ongoing support in managing and maintaining digital community. | 19.1 Engage with Departmental IT providers and review contractual responsibilities for Digital Continuity. | 3 years | | 20. HMRC should undertake a full impact assessment prior to any technological change that may affect the completeness, availability and usability of the Department’s information assets. | 20.1 Review current IT Architecture change process and assess effectiveness prior to any proposed change. | 3 years | | Recommendation | Actions | Timescale | |----------------|---------|-----------| | 21. HMRC should undertake a limited review of BDApps with respect to digital continuity in order to manage and mitigate the risks of these applications until a longer term solution has been agreed. | 21.1 Republish the definition of a BDApp. 21.2 Ensure that BDApps appear on asset registers and that digital continuity forms part of the review. | 6 – 12 months | | 22. HMRC to carry out assurance that all staff, including managers leading by example, adhere to the email policy and do regular ‘housekeeping’ of their records. | 22.1 Review e-mail assurance process in Lines of Business. 22.2 Communicate best practice for e-mail housekeeping. | 6 – 12 months | | 23. HMRC should develop information networks to share good practice across the organisation and build a professional community of shared interest in KIM. | 23.1 Expand work to engage with existing and emerging KIM communities 23.2 Identify synergies with other Departmental initiatives. | 6 months – 3 years | | 24. HMRC should clarify its guidance on how internal personal information should be managed to increase compliance across the Department. | 24.1 Identify best practice in conjunction with People Function and Security. 24.2 Review and publicise guidance on managing employee information. | 12 months | | 25. HMRC to assess the validity of incorporating a review date in its Gateway memorandum of understanding covering use of its data. | 25. Benchmark arrangements employed by OGDs and submit findings / recommendations for senior management approval | 6 – 12 months | | 26. HMRC to monitor whether data is being used as prescribed in the Gateway Agreements. | 26.1 Review current arrangements in line with draft ICO Code. 26.2 Explore benchmarking Other Government Departments (OGDs) | 6 months | | 27. HMRC should identify what further information it can make available as part of the drive to open up public data. | 27.1 Review with directorate Project Group consulting with Cabinet Office and Office of Public Sector Information. | 12 months | | 28. HMRC needs to further improve assurance of third party contractors | 28.1 Review with the Supplier Security Assurance Group. 28.2 Revise and implement output as appropriate. | 12 months | | Recommendation | Actions | Timescale | |----------------|---------|-----------| | 29. HMRC to reinforce the usage of the Data Security Handbook’s guidance on Protective Marking to all staff. | 29.1 Establish a suitable communications strategy and include topic in planned Security events. | 6 months | | 30. HMRC should ensure that the individuals’ assigned KIM roles are given the appropriate amount of time and support to meet their KIM responsibilities | 30.1 Ensure resource plans reflect KIM roles | 12 months | | 31. HMRC must exercise control over the business areas when they adopt, amend and publish KAI policies to ensure that only the latest versions of the policies are utilised. | 31.1 Establish quality review procedures for Line of Business generated guidance and policies. | 12 months – 3 years | | 32. HMRC to provide supplementary material to support the KIM e-learning package or incorporate this into the Data Security Handbook. | 32.1 Review education & awareness options. 32.2 Review Data Security handbook content. | 12 months | | 33. HMRC should include KIM training within induction training for new staff. | 33.1 Review Induction Checklists with all stakeholders to ensure consistent messages. 33.2 Amend checklists and process as appropriate. 33.3 Develop new training modules as required | 12 months | | 34. HMRC should implement appropriate KIM training for each of the specific Departmental KIM roles. | 34.1 Conduct a training needs analysis and develop content for each of the KIM roles, incorporating the output of the review of competencies/capabilities. | 12 months | | 35. HMRC should incorporate KIM into Pacesetter principles to support raising the awareness and the benefits of KIM across the Department. | 35.1 Continue with the existing KIM Pacesetter project and develop strategy for putting KIM into Pacesetter. | 12 months | | 36. HMRC should review and assess how to engage middle managers in supporting the KIM agenda. | 36.1 Analyse the results from the latest KIM Awareness survey and identify areas for improvement. 36.2 Identify with focus groups on the best way to engage with middle managers. | 12 months | | Recommendation | Actions | Timescale | |-------------------------------------------------------------------------------|-------------------------------------------------------------------------|-----------| | 37. HMRC should establish formal handover procedures to capture knowledge on internal transfer. | 37.1 Identify the current ‘exit and handover’ processes\
37.2 Review with stakeholders and amend processes as necessary. | 12 months | | 38. HMRC should establish an online KIM space to capture and share examples of good KIM practice. | 38.1 Identify opportunities for online knowledge sharing, line to ongoing associated projects.\
38.2 Ensure communication of outputs across HMRC. | 12 months |